CVE-2026-51738: TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
Description
Frequently Asked Questions
1
Which devices are known to be affected?
The affected product identified in the available data is TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015.
2
Does exploitation require authentication or prior access?
No. The issue can be exploited by an unauthenticated attacker using a crafted POST request to /cgi-bin/cstecgi.cgi.
3
What is the practical impact of successful exploitation?
An attacker can reset the device configuration and reboot the device.